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What is claimed is: 

1. A method foAmonitoring an incoming data stream for specified events, 
comprising: 

receiving at least one data, stream at a computer, the data stream including data 
representative of events; and \ 

applying rules to the data stream for sorting data representative of events and for 
taking an action based on a specified event^ 

The method of claim 1, comprising displaying events associated with a 
selected data s^feam on a time line. 



3, The method of claim 1 )\g|5bmprising gathering data at a remote location and' 
placing the gathered data in a data|Meam and forwarding the data stream to the 
computer. \ 



4. The method of claim 3,\vherein said gathering step is performed by an 
agent. \ 

The method of claim 1, comprising hunting for predetermined data at a 
remote loc^on and placing the himted data in a data stream and forwarding the data 
stream to the cbmputer. 



6. The nitssfliod of claim 5, wherein said hunting step is performed by an 



agent. 



, 7. 
placed in the 



The method of cl 
data stream. 



im 5, comprising normalizing the data before the data is 
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The method of claim 1, wherein the at least one data stream includes 
message treiffic. 



9. Th^ method of claim 5, comprising linking the hunted data with a location 
where the hunted dW was located. 

10. The method of claim 9, comprising updating the received hunted data with 
new hunted data as new data is received at the hunted data location. 



11. The method otSclaim 6, comprising constructing an event stream object 



which is forwarded to the compute 



sby the agent. 



12. The method of clairq 11, wherein the event stream object includes 
information descriptive of an event. 



13. The method of claim 12, wherein the information includes at least one of 
the following: the time that the event occurre^; the duration that event covered; and key 
words that describe the event. 




\4, The method of claim 1, comprising filing the sorted information in 
separate data stream files. 



15. The method of claim 1, wherein an event is comprised of at least one of 
the following elemeirts: type, title, datetime, keywords, summary, priority and duration. 

16. The methoH^of claim 1, wherein a rule includes a criteria component and 
an action component. 



17. The method of claiik 16, wherein the criteria component includes at least 
one criteria statement and to satisfy\rule either all, any or none of the at least one 
criteria statements need to be satisfied. 



The method of claim 17, wherein at least one action is taken if the at least 
one rule is sh^sfied. 

19. TheNnethod of claim 1, wherein the data in the event data stream is 
received in a standardized format. 



20. The method orsclaim 14, comprising displaying an event stream using 
information stored in stored data stseam files. 



21. The method of 
received sorted data stream. 
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comprising displaying an event stream using a 



22. An articla comprising: 

at least one sequence of machine executable instructions; 
a medium bearing the executable instructions in machine readable form, wherein 
execution of the instruction^ by one or more processors causes the one or more 
processors to: 

receive at least one data "^eam at a computer, the data stream including data 
representative of events; and 

apply rules to the data streamVor sorting data representative of events and for 
taking an action based on a specified event. 



25v The article of claim 22, comprising causing the processor to display events 
associated wuh^a selected data stream on a time line. 

24. A computer architecture^ for monitoring an incoming data stream for 
specified events, comprising: 

receiving means for receiving at leiast one data stream at a computer, the data 
stream including data representative of events\ and 
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applying means for applying rules to the data stream for sorting data 
representative of even\s and for taking an action based on a specified event. 

25. The computer aromtecture of claim 24, comprising displaying means for 
displaying events associated wim^a selected data stream on a time line. 



□ 

-fll 



26. A computer system, comprising: 
a processor; and 

a memory coupled t6. said processor, the memory having stored therein sequences 
of instructions, which, when executed by said processor, causes said processor to perform 
5 the steps of: 

receiving at least one dat^ stream at a computer, the data stream including data 
representative of events; and 

applying rules to the data streiun for sorting data representative of events and for 
taking an action based on a specified evW. 
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2 \ The computer system of claim 26, comprising causing the processor to 



display evem^^sociated with a selected data stream on a time line. 



